Address code review feedback: fix SQL injection, QueueMetrics bug, reduce boilerplate

[Copilot]

Description

Addresses three code review comments on PR #21:

1. Fixed SQL injection vulnerability in send operations

• Replaced f-string query construction with parameterized queries in _get_send_statement and _get_send_batch_statement
• Updated send, send_async, send_batch, send_batch_async to pass parameters to execute()

Before:

def _get_send_statement(queue_name: str, message: dict, delay: int) -> str:
    encoded_message = encode_dict_to_psql(message)
    return f"select * from pgmq.send('{queue_name}',{encoded_message},{delay});"

After:

def _get_send_statement(queue_name: str, message: dict, delay: int) -> Tuple[str, Dict[str, Any]]:
    return (
        "select * from pgmq.send(:queue_name, :message::jsonb, :delay);",
        {"queue_name": queue_name, "message": json.dumps(message), "delay": delay},
    )

2. Fixed QueueMetrics initialization error

• Removed invalid scrape_time parameter from all metrics methods
• QueueMetrics dataclass only defines 5 fields, was being called with 6

3. Reduced boilerplate in queue.py

• Added _execute_operation helper to eliminate sync/async session management duplication
• Refactored 7 methods: create_queue, create_partitioned_queue, validate_queue_name, drop_queue, list_queues, send, send_batch
• Reduced ~150 lines of repetitive code

4. Added comprehensive tests for PGMQOperation

• Created tests/test_operation.py with 18+ test cases covering sync and async static methods
• Tests queue operations, message handling, metrics, and transaction control

Status

• In progress
• Ready for review
• Done

Checklist

• Read the Contributing Guide
• Passes tests
• Linted ( we use pre-commit with ruff )
• Updated documentation

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.